#43 - Verified, Authorized, and Compromised: The Return of the Air Gap

Three labs. Five breached companies. One testing vendor named Irregular.This summer handed identity and security practitioners a masterclass in what happens when AI agents hit environments that weren't built for them. Not through sophisticated cyberattacks. Through configuration mistakes, weak passwords, and an optimizer that found a shortcut through Hugging Face's production infrastructure because the answer key wasn't in the sandbox.In this episode, I walk through all three incidents - OpenAI's ExploitGym escape, Anthropic's 141,006-evaluation audit, and the invisible HTML comment that turns your developer's AI assistant into an insider threat. Then I go somewhere the coverage hasn't: what the narrative around these incidents is doing to how practitioners make decisions, and why fear and FOMO are the same emotiondepending on which side of the paywall you're standing on. Then we get practical. The identity air gap isn't about going back to 2003. It's about protecting the quality of your strongest signal, in a decision control plane that evaluates attributes like provenance, location, and device posture to produce a fidelity assessment. Agents introduced an attribute nobody was capturing. This episode is about capturing it. Separate trust planes per environment. No credential valid in two worlds. Every crossing brokered, scoped, and provable end to end. Sever the path. Or make it provable. Thank you for listeningLinkedIn: https://www.linkedin.com/in/rohit-agnihotriEmail: [email protected]